hMailServer config

Been running some scripts against hMailServer, it would appear that numerous failed login attempts arent caught without a username group

With the provided config, my script can make dozens of login attempts before being caught

Since the username is base64 encoded, and may not always occur in the right order anyways, it may not be useful to try to get that with regex, so I’ve been using the session ID as a username, like so

"SMTPD"\s\d+\s(?<username>[^"]+)\s"(?<timestamp>[^"]+)"[^"]+"(?<ipaddress>[^"]+)"[^"]+"SENT:.+(530|535)

This way every single login attempt is caught, I thought this might have something to do with timestamp format, but I tried changing that to match what I see in logs

yyyy-MM-dd HH:mm:ss.SSS = 2022-04-26 19:33:01.195?

Is this the right way to define the timestamp format?

Also, 334 is part of any login attempt, and shouldn’t be included in the failed regex

[jjxtra]

Can you send your logfile to [e-mail], I’d like to see why the regex is missing on some of the failed logins still…?

[jjxtra]

I updated the recipe